OpenLDAP add-on fields extraction

[kevinleeV]

I recently installed openldap add-on on both splunk cloud instance and splunk enterprise security instance

https://splunkbase.splunk.com/app/3520/

However, the fields extraction only occurs within splunk cloud instance, not ES. How does this happen? What would be a fix for this?

[kchamplin_splun]

This is likely due to app-imports-update mod input not configured to accept the OpenLDAP app name:
https://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps

[kevinleeV]

I can see Splunk_TA_openldap being imported within ES when below command is performed. Seems like apps are being imported

| rest /servicesNS/admin/system/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local | fields import

[kthammireddygar]

i assume you have done debug/refresh.

Search :
index=yourindex sourcetype=ldap modifiersname=*

try this search on both the instances.

[kevinleeV]

When your modifiedersname is searched in ES, no results get returned, while you get a bunch of data within Splunk cloud

[kthammireddygar]

Can you please check Permissions for openldap add-on?
Is it Private or Global or App?
Please make it Global.

[kevinleeV]

It was set to App and I changed to Global. However, there is no difference in fields extraction.